# What do the multiple ports mean while running graylog through docker?

**URL:** <https://community.graylog.org/t/what-do-the-multiple-ports-mean-while-running-graylog-through-docker/13061>\
**Category:** Graylog Central (peer support)\
**Created:** [December 4, 2019, 12:34pm UTC](https://community.graylog.org/t/what-do-the-multiple-ports-mean-while-running-graylog-through-docker/13061 "2019-12-04T12:34:37Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![priyanker](https://avatars.discourse-cdn.com/v4/letter/p/ea5d25/32.png) [@priyanker](https://community.graylog.org/u/priyanker)\
**Post date:** [December 4, 2019, 12:34pm UTC](https://community.graylog.org/t/what-do-the-multiple-ports-mean-while-running-graylog-through-docker/13061/1 "2019-12-04T12:34:37Z")

</div>

I followed the steps mentioned in the [documentation](https://docs.graylog.org/en/3.1/pages/installation/docker.html) for installing graylog through docker.

`docker run --name mongo -d mongo:3`

```
docker run --name elasticsearch \
    -e "http.host=0.0.0.0" \
    -e "ES_JAVA_OPTS=-Xms512m -Xmx512m" \
    -d docker.elastic.co/elasticsearch/elasticsearch-oss:6.8.2

 docker run --link mongo --link elasticsearch \
    -p 9000:9000 -p 12201:12201 -p 1514:1514 -p 5046:5046 \
    -e GRAYLOG_HTTP_EXTERNAL_URI="http://127.0.0.1:9000/" \
    -d graylog/graylog:3.1

```

What do all these ports mean?

I created a GELF UDP input in graylog with bind address 0.0.0.0 and port 5046  
I added the following log4net AsyncGelfUdpAppender appender in my .Net project.

```
<appender name="AsyncGelfUdpAppender" type="Gelf4Net.Appender.AsyncGelfUdpAppender, Gelf4Net">
    <!-- Number of log lines to buffer for async send. Defaults to 10-->
    <bufferSize value="20" />
    <!-- Number of tasks to use for the async appender. 0 or fewer indicates one task per processor-->
    <threads value="2" />
    <remoteAddress value="127.0.0.1" />
    <remotePort value="5046" />
    <layout type="Gelf4Net.Layout.GelfLayout, Gelf4Net">
        <param name="AdditionalFields" value="app:AsyncUdpAppender,version:1.0,Environment:Dev,Level:%level" />
        <param name="Facility" value="RandomPhrases" />
        <param name="IncludeLocationInformation" value="true" />
        <param name="SendTimeStampAsString" value="true"/>
    </layout>
  </appender>

```

But no messages are getting logged to graylog.

---

<div class="post-metadata">

**Author:** ![maniel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/maniel/32/58_2.png) [@maniel](https://community.graylog.org/u/maniel)\
**Post date:** [December 5, 2019, 11:04am UTC](https://community.graylog.org/t/what-do-the-multiple-ports-mean-while-running-graylog-through-docker/13061/2 "2019-12-05T11:04:56Z")

</div>

Deploying via docker you just expose ports you use in your app, in case of docker it really depends ports your inputs listen on, in this case you need **9000** for graylog’s web interface and REST API, **1514** is probably syslog (514) upped by 1000 because non-root user can’t use ports smaller than 1024 (?), you don’t really need it if you don’t use corresponding input in graylog, **5046** is the port you need for your input, additionally to expose udp port you need to append `/udp`, in your case it should be `-p 5046:5046/udp`

---

<div class="post-metadata">

**Author:** ![priyanker](https://avatars.discourse-cdn.com/v4/letter/p/ea5d25/32.png) [@priyanker](https://community.graylog.org/u/priyanker)\
**Post date:** [December 5, 2019, 11:08am UTC](https://community.graylog.org/t/what-do-the-multiple-ports-mean-while-running-graylog-through-docker/13061/3 "2019-12-05T11:08:17Z")

</div>

I did try this.  
docker run --link mongo --link elasticsearch   
-p 9000:9000 -p 12201:12201 -p 5046:5046/udp   
-e GRAYLOG\_HTTP\_EXTERNAL\_URI=“[http://127.0.0.1:9000/](http://127.0.0.1:9000/)”   
-d graylog/graylog:3.1

What should the bind address be when I create an input in Graylog? Right now, it’s 0.0.0.0 and still with this configuration, I see no messages in Graylog when I log through my application.

What do you think should be the remoteAddress and remotePort value if I use the docker command above?

---

<div class="post-metadata">

**Author:** ![maniel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/maniel/32/58_2.png) [@maniel](https://community.graylog.org/u/maniel)\
**Post date:** [December 5, 2019, 11:19am UTC](https://community.graylog.org/t/what-do-the-multiple-ports-mean-while-running-graylog-through-docker/13061/4 "2019-12-05T11:19:21Z")

</div>

weird, it should work, maybe try external ip address of the machine you run dockerized graylog on

---

<div class="post-metadata">

**Author:** ![priyanker](https://avatars.discourse-cdn.com/v4/letter/p/ea5d25/32.png) [@priyanker](https://community.graylog.org/u/priyanker)\
**Post date:** [December 5, 2019, 11:20am UTC](https://community.graylog.org/t/what-do-the-multiple-ports-mean-while-running-graylog-through-docker/13061/5 "2019-12-05T11:20:21Z")

</div>

Do you think these values are correct?

```
<remoteAddress value="127.0.0.1" />
    <remotePort value="5046" />

```

And should I change the bind address to 127.0.0.1 from 0.0.0.0 and port from 5046 to something else when creating a GELF UDP input?

---

<div class="post-metadata">

**Author:** ![maniel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/maniel/32/58_2.png) [@maniel](https://community.graylog.org/u/maniel)\
**Post date:** [December 5, 2019, 11:24am UTC](https://community.graylog.org/t/what-do-the-multiple-ports-mean-while-running-graylog-through-docker/13061/6 "2019-12-05T11:24:19Z")

</div>

no, 0.0.0.0 should be ok in input config, i was suggesting using non local ip address in `remoteAddress`, like ip of your machine instead of 127.0.0.1

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [December 19, 2019, 11:24am UTC](https://community.graylog.org/t/what-do-the-multiple-ports-mean-while-running-graylog-through-docker/13061/7 "2019-12-19T11:24:20Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.